AliExpress Got Caught Using Inaudible Sound To Track Users

by Aaron Leong — Tuesday, August 25, 2026, 11:37 AM EDT

Alibaba headquarters in Hangzhou, China - Image: Zhang Hui via Unsplash

Uh-oh, e-commerce giant AliExpress has been caught running hidden, silent audio processes inside visitors' browsers to generate unique device tracking profiles without user consent.

This naughty deed was uncovered after software developer Matt Callaghan investigated why his multipoint Bluetooth headphones inexplicably stopped playing music from his phone whenever an AliExpress tab sat open on his computer. Callaghan discovered that loading the retail platform's homepage executed highly obfuscated JavaScript files—collina.js and fireyejs.js—associated with Alibaba's browser security and anti-fraud infrastructure.

Rather than hijacking microphones, these scripts leverage the Web Audio API to build an internal audio-processing graph. According to Callaghan's diagnosis, the system uses a sawtooth oscillator to generate a precise waveform, passes it through an analyzer, and evaluates the resulting frequency data to measure the tiny mathematical variations in how a given browser, central processing unit, and audio driver process sound signals. Because these hardware and software micro-differences are virtually unique to each individual setup, the script can synthesize a persistent digital identifier that tracks shoppers across the web without relying on HTTP cookies or local browser storage.

Front of Alibaba headquarters in Hangzhou, China — Alibaba headquarters in Hangzhou, China - Image: Ma Zonghe via Unsplash

What makes the technique particularly insidious is its silent execution and resistance to standard browser controls. The scripts deliberately set the audio gain to zero, rendering the signal entirely inaudible to human ears. However, because the processing graph remains actively connected to the system's underlying audio output destination, the browser treats the page as an active media player. Consequently, muting the specific browser tab, muting the entire web browser, or turning off sound in the OS fails to stop the background code from executing. This persistent active state keeps the device's audio hardware engaged, which is precisely what hijacked Callaghan's multipoint Bluetooth setup by tricking his headphones into prioritizing a silent PC stream over audio from his smartphone.

Oh, but it doesn't end there! A deeper script dive revealed that AliExpress combines WebAudio data with a comprehensive array of device metrics, including HTML5 canvas rendering via toDataURL(), WebGL shader precision, screen dimensions, device pixel ratios, memory capacity, hardware concurrency, installed browser plugins, WebRTC networking behavior, and even live user interaction metrics like mouse and touch movements.

The irony here is that fingerprinting scripts are often seen as anti-abuse mechanisms designed to combat automated bots, fraudulent transactions, and credential stuffing. However, deploying them silently isn't kosher. Fortunately for privacy-conscious shoppers, privacy-focused browsers already offer built-in mitigations. For instance, Brave automatically injects randomized noise into Web Audio outputs to scramble fingerprinting attempts, while Firefox utilizes uniform, cross-platform math libraries to eliminate hardware-specific frequency deviations.